From: Ben Pfaff <blp@nicira.com>
Date: Sun, 24 Jun 2012 05:34:39 +0000 (-0700)
Subject: ofp-util: Avoid use-after-free in ofputil_encode_flow_mod().
X-Git-Tag: v1.7.0~18
X-Git-Url: http://git.cascardo.eti.br/?a=commitdiff_plain;h=47f200357a3a19e9553c96b9749397c4812ebfce;p=cascardo%2Fovs.git

ofp-util: Avoid use-after-free in ofputil_encode_flow_mod().

nx_put_match() can reallocate the ofpbuf's data so we need to reload the
pointer.

Found by inspection.

Signed-off-by: Ben Pfaff <blp@nicira.com>
---

diff --git a/lib/ofp-util.c b/lib/ofp-util.c
index 15de6076f..655746f75 100644
--- a/lib/ofp-util.c
+++ b/lib/ofp-util.c
@@ -1496,10 +1496,10 @@ ofputil_encode_flow_mod(const struct ofputil_flow_mod *fm,
     case OFPUTIL_P_NXM_TID:
         msg = ofpbuf_new(sizeof *nfm + NXM_TYPICAL_LEN + actions_len);
         put_nxmsg(sizeof *nfm, NXT_FLOW_MOD, msg);
+        match_len = nx_put_match(msg, &fm->cr, fm->cookie, fm->cookie_mask);
         nfm = msg->data;
         nfm->command = htons(command);
         nfm->cookie = fm->new_cookie;
-        match_len = nx_put_match(msg, &fm->cr, fm->cookie, fm->cookie_mask);
         nfm->idle_timeout = htons(fm->idle_timeout);
         nfm->hard_timeout = htons(fm->hard_timeout);
         nfm->priority = htons(fm->cr.priority);